Monday, September 1, 2014

Find the original user of a process invoked by sudo

Let's say you want to find out who kicked off the most memory consuming process using root.

1) open top.
2) sort by mem by pressing >
3) write down the pid
4) sudo vim /proc/<pid>/environ , you will find the the user in: SUDO_USER='\<user\>'

There are some other ways: